From c2dc7eff4470c3ea021a3b014071ab33f5641ade Mon Sep 17 00:00:00 2001 From: Boris Brezillon Date: Fri, 26 Apr 2024 09:29:10 +0000 Subject: [PATCH] panfrost: do not write outside num_wg_sysval This array has 3 components, because it's meant to hold the X, Y and Z components of the work-group size sysval. However, mir_pick_ubo assumes vec4 for the push-uniforms, which ends up promoting this to 4 components. So let's make sure we don't write that last component. It's not going to do anything good. In practice, this leads to the viewport descriptor being smashed, which doesn't actually do any real-world harm, because this only happens in compute batches where that descriptor is unused. However, writing outside of arrays is undefined behavior, so we should fix it regardless. Fixes: 50061670614 ("panfrost: Hook-up indirect dispatch support") Reviewed-by: Erik Faye-Lund Part-of: (cherry picked from commit 186f7fa915b1d748f73a13f12c089af4e47b5c29) --- .pick_status.json | 2 +- src/gallium/drivers/panfrost/pan_cmdstream.c | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.pick_status.json b/.pick_status.json index c7c9f5c3883..1eef26efb16 100644 --- a/.pick_status.json +++ b/.pick_status.json @@ -1304,7 +1304,7 @@ "description": "panfrost: do not write outside num_wg_sysval", "nominated": true, "nomination_type": 1, - "resolution": 0, + "resolution": 1, "main_sha": null, "because_sha": "500616706148d2e340bbdfecad45204b515ae9b5", "notes": null diff --git a/src/gallium/drivers/panfrost/pan_cmdstream.c b/src/gallium/drivers/panfrost/pan_cmdstream.c index c68825f3dbc..2b3ce2275b4 100644 --- a/src/gallium/drivers/panfrost/pan_cmdstream.c +++ b/src/gallium/drivers/panfrost/pan_cmdstream.c @@ -1380,7 +1380,8 @@ panfrost_emit_const_buf(struct panfrost_batch *batch, PAN_SYSVAL_TYPE(ss->sysvals.sysvals[sysval_idx]); mali_ptr ptr = push_transfer.gpu + (4 * i); - if (sysval_type == PAN_SYSVAL_NUM_WORK_GROUPS) + if (sysval_type == PAN_SYSVAL_NUM_WORK_GROUPS && + sysval_comp < ARRAY_SIZE(batch->num_wg_sysval)) batch->num_wg_sysval[sysval_comp] = ptr; } /* Map the UBO, this should be cheap. For some buffers this may